I was chatting with George Crump — VergeIO's CMO, and someone who's been around storage and virtualization long enough to have watched the whole HCI story play out — and we got onto how much of my writing dives straight into the deep end: Kubernetes, reconcilers, firewall automation. Fun for the people already swimming, but not much of a ladder for everyone standing at the edge of the pool. His suggestion was simple: start at the beginning. Do a "What Is a…" series. One VergeOS concept at a time, no assumptions, the way you'd explain it to a smart friend who's just kicking the tires.

So here we are. This is the first one — and George, this series is your fault. We're starting with the internal network, because almost everything else in VergeOS networking builds on it.

(The format: short, plain-language, one concept per post, with a homelab example and the reason it matters at production scale. No deep dives — those will keep.)

In one sentence

An internal network in VergeOS is a private virtual network you create inside VergeOS itself — and it comes with its own router, DHCP server, DNS, and firewall built in.

The analogy

Think of an internal network as plugging in a brand-new wireless router, except there's no box, no cables, and it appears in about two seconds. That virtual router hands out IP addresses (DHCP), answers name lookups (DNS), filters traffic (firewall), and routes packets — all the things your home router does, except it lives entirely in software and you can spin up as many as you want.

The official docs put it plainly: "Internal networks are VNets originated within VergeOS." The key word is originated — VergeOS isn't bridging you onto some existing physical network; it's creating a fresh one.

How it actually works

When you create an internal network, you pick an IP Address Type, and that single choice decides how much VergeOS does for you:

• Layer 3 (static) — the recommended option. You get "a layer 3 network with routing, DNS, DHCP features available." VergeOS stands up a virtual router for the network and manages the lot: a DHCP server (on by default, with a scope you set), DNS (BIND, simple forwarding, or off), firewall and routing rules, even optional rate limiting on the router.
• Layer 2 (None) — "a simple layer2 network in which network administration is to be performed via third-party applications." No built-in router; you bring your own. Useful, but most of the time Layer 3 is what you want.

Two details that surprise people:

Each internal network is its own VXLAN. That's the encapsulation tech that lets VergeOS carve out thousands of isolated networks over the same physical hardware — no switch reconfiguration, no VLAN tag juggling. Because each one is separately encapsulated, "unique network addresses are not necessarily required" — you can run 10.0.0.0/24 in five different internal networks and they won't collide, as long as they sit behind NAT.

Getting out to the internet is one dropdown. An internal network is sealed off by default. To give it outside access, you "select the proper external network as the default gateway," and VergeOS notes that "an appropriate routing rule will be created automatically." No hand-writing NAT rules — you point it at an external network and the plumbing appears.

Try it yourself: build one in under a minute

Enough theory — here's the actual click-path. This is all in the VergeOS UI, no command line required. You'll need access to your VergeOS system and an existing external network to use as the gateway (most systems have one out of the box).

1. Open the network creator. In the VergeOS UI, go to Networks, then choose New Internal.

2. Name it. Give it something descriptive — lab-net, web-tier, whatever fits. No spaces (VergeOS won't accept them).

3. Pick the IP Address Type. Choose Static — that's the one that gives you the full Layer 3 network with routing, DHCP, and DNS built in. (The "None" option gives a bare Layer 2 segment instead; skip it unless you specifically want that.)

4. Set the network address. This is the subnet the network will hand out, in CIDR — e.g. 10.10.0.0/24. VergeOS pre-fills a default (from System > Settings > Advanced > Default internal network address), but you can change it to whatever range you like. Remember: because each internal network is its own VXLAN, this doesn't have to be globally unique.

5. Choose a DNS option. For most cases, simple forwarding is fine — your VMs will be able to resolve names. You can also run full BIND DNS or turn it off entirely.

6. Select the Default Gateway. Pick your external network here. This is the step that gives the network a way out to the rest of the world — VergeOS creates the routing rule for you automatically. (Leave it unset and the network stays fully isolated, which is sometimes exactly what you want.)

7. Configure DHCP. It's on by default. Optionally set a domain name and a start/stop address range for the DHCP pool. Leave the defaults and it'll just work.

8. Submit, then Start the network so it powers on.

Now prove it works: create or edit a VM, add a NIC, and attach it to your new network. Boot the VM — it should pick up an address from the DHCP pool automatically, reach other VMs on the same network, and (if you set the gateway in step 6) reach the internet. That's a complete, isolated, routed network — built in less time than it took to read this section.

In the homelab

On my cluster, "External" is the network bridged to my physical LAN, and almost everything else is internal. When I built a host network for some Kubernetes experiments, I made an internal Layer 3 network on 10.20.0.0/24. VergeOS immediately gave it a gateway, a DHCP pool, and DNS — I just deployed VMs onto it and they got addresses and could talk to each other. To let them reach the internet, I picked "External" as the default gateway, and the route was there. Total config time: under a minute, entirely in the UI.

The nice part: that 10.20.0.0/24 network is completely isolated from my other internal networks. I could stand up another one on the same 10.20.0.0/24 for a different project and they'd never see each other — different VXLANs, no conflict.

Why it matters (beyond the lab)

In traditional infrastructure, "give me a new isolated network" is a ticket: VLAN assignment on the switches, a subnet from the IPAM team, firewall rules from netsec, maybe a router interface. Days, sometimes.

In VergeOS, an internal network is a self-contained unit of segmentation you create on demand. Each one is its own VXLAN with its own router and firewall, so isolation is the default, not something you bolt on. That's the foundation under multi-tenancy, micro-segmentation, and per-application network boundaries — and it's why "spin up an isolated three-tier app network" stops being a cross-team project and becomes a two-minute task. The homelab convenience and the enterprise capability are the same feature; you're just running it at different scales.

What trips people up

• Spaces in the name. VergeOS won't accept them — name your network web-tier, not web tier.
• Forgetting the gateway. A fresh internal network is intentionally sealed. If your VMs can get addresses but can't reach the internet, you almost certainly haven't selected an external network as the default gateway yet.
• Layer 2 when you meant Layer 3. If you picked the "None" IP type, you got a bare Layer 2 segment with no DHCP/DNS/firewall — great if that's the plan, confusing if you expected the batteries-included version. For most uses, choose the static (Layer 3) type.

Next in the series

Internal networks only get interesting once they can talk to the outside — so the next post answers "How to connect an VM to an internal network?" After that: External Network, VXLAN, firewall rules, and tenants.

Sources: Creating an Internal Network - VergeOS Docs · Network Design Models - VergeOS Docs